HIPAA compliance is not optional, it is not aspirational, and it is not something you can patch together after the fact. As a covered entity — which every healthcare provider who transmits protected health information electronically becomes — you have specific, mandatory obligations under HIPAA’s Privacy Rule and Security Rule. The good news is that compliance for a solo or small telehealth practice is manageable when addressed systematically from the start.
The Privacy Rule governs how you use and disclose protected health information (PHI). It requires you to have a written Privacy Policy, to provide patients with a Notice of Privacy Practices (NPP) at the time of first service, to designate a Privacy Officer (which can be yourself), to train workforce members on privacy practices, and to have procedures for handling patient requests for access to their records.
The Security Rule governs the protection of electronic PHI (ePHI). It requires you to conduct a risk assessment identifying where ePHI is stored, transmitted, and accessed; to implement technical safeguards (encryption, access controls, audit logs) across all systems that touch ePHI; to have a data breach response plan; and to maintain documentation of all security measures.
Business Associate Agreements (BAAs) are required with every vendor who handles your patients’ PHI. This includes your EHR vendor, your telehealth platform, your lab partners, your compounding pharmacies (for prescription-related PHI), your email provider if it touches PHI, your cloud storage provider, and any billing service. A BAA must be in place before you share patient data with any vendor. Most major vendors in the healthcare technology space have standard BAAs available — get them signed before you go live.
For telehealth specifically, your video platform must be HIPAA-compliant and provide a BAA. Free consumer video tools (regular Zoom, FaceTime, Skype) are not acceptable for telehealth without a BAA in place. HIPAA-compliant options that provide BAAs include Zoom for Healthcare, Doxy.me, and your EHR’s built-in telehealth module if it includes one.
HIPAA compliance setup is covered in Session A of our Practitioner Training. Book your session here or call 844-734-2112.
Ready to build your own telemedicine hormone clinic?
Clinic In A Box™ is our 3-month, done-with-you program to launch and scale your own practice — systems, compliance, labs, pharmacy, and patient acquisition, all built with you.